[aprssig] aprsis DOS in Poland, observation
spam8mybrain at yahoo.com
Sat Sep 5 13:46:49 EDT 2020
The mechanism to use PKI already exists, but there are a lot of issues regarding administration that haven't been resolved, and it still doesn't protect against abusive behavior by an authenticated user.
Plus, since many APRS-IS clients don't support TLS connections to the backbone, we still have to support the completely compromised passcode means of authentication. Hence why I proposed a throttling solution to protect against hostile attackers (who, by definition, aren't going to play nice with the rest of us). Now whether a PKI-authenticated client could be granted a higher throttling threshold is a different issue, but it still goes back to the unresolved PKI administration issues (such as why, currently, a single US-based entity [the ARRL] is the sole gatekeeper to PKI-authenticated access to the world-wide APRS-IS).Andrew, KA2DDO
-------- Original message --------
From: Mobilinkd LLC <mobilinkd at gmail.com>
Date: 9/5/20 13:07 (GMT-05:00)
To: Heikki Hannikainen <hessu at hes.iki.fi>
Cc: TAPR APRS Mailing List <aprssig at lists.tapr.org>
Subject: Re: [aprssig] aprsis DOS in Poland, observation
Would it be worthwhile discussing whether to use PKI for APRS-IS authentication?I just discovered that there is a registered X.509 extension for ham radio callsigns and that we already have a CA in LOTW.https://perens.com/2019/07/02/yes-it-is-legal-to-use-cryptographic-signature-on-amateur-radio-and-thats-important/Kind Regards,Rob Riggs WX9OMobilinkd LLCOn Sat, Sep 5, 2020 at 6:15 AM Heikki Hannikainen <hessu at hes.iki.fi> wrote:On Fri, 4 Sep 2020, Bill Vodall wrote:
> Is aprs-is under a Denial of Services attack by jankesi and others?
> Looks like multiple packets arriving every second.
The packet rate during the DOS abuse event last night was some 1500-1700
packets per second at peak.
Some APRS-IS clients on the full feed could not take this traffic (too
slow to process, or too slow network, buffers fill up) and got
disconnected. As a network traffic rate, it was only around 1.4 Mbit/s sec
though. Due to a bug, the two APRS-IS data aggregator aprsc instances at
aprs.fi crashed too, leaving aprs.fi without a data feed.
This is how it looked on the map, screen shot courtesy of Mateusz Szyper
on the aprs.fi discussion group:
And here are a few sample packets, showing what the randomly generated
packets looked like. The coordinates are random, in Poland, with the
clear intention of polluting the map fully.
2020-09-04 19:48:27 EEST: CI37PA>APDR16,WIDE3-3,qAC,SQ6KPO-1:=5031.68N\01844.35EZ jeszcze nie dojrzalem.
2020-09-04 19:48:46 EEST: CI371PY-3>APDR16,WIDE3-3,qAC,SQ6KPO-1:=5248.72N/01933.83EX sie draznic z ludzmi.
2020-09-04 19:45:58 EEST: CI37PA-21>APDR16,WIDE3-3,qAC,SQ6KPO-1:=5411.38N\01600.85E-2 Jebane kurwy cebulaki.
2020-09-04 19:48:56 EEST: CI37PA-20>APDR16,WIDE3-3,qAC,SQ6KPO-1:=5051.97N/01543.24Eb masz, masz.
2020-09-04 19:49:26 EEST: CI37PA-88>APDR16,WIDE3-3,qAC,SQ6KPO-1:=5002.85N/02147.17Ec pomarancza kurwo niebieska.
Here's more, each source callsign emitted packets at random coordinates
with comments from some pool of (obscene) text, so you can just pick one
call and watch:
I haven't looked at a large data set yet; these samples were from a very
small set of a thousand packets that I took a quick look at now. These
packets were injected using an igate call of SQ6KPO-1 but there's no
reason why that could not be a random call in the future. Also, it would
be *very* unlikely that SQ6KPO is the callsign of the person doing this
abuse - it is more likely that the intention is to abuse him by using his
It's easy to write a client to do this kind of abuse, and easy to improve
it (make more things random), and after that it's quite difficult to fully
This is just to describe what happened, and what you should expect to see
in the future. We've been lucky to have very little abuse and DOS attacks
aprssig mailing list
aprssig at lists.tapr.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the aprssig